Universally_challenged Posted May 3, 2011 Posted May 3, 2011 Hi Guys. I think this is my first post here, but i have watched for a while. Anyway, I'll cut to the chase. Last week was the first day back for our kids at our primary school. During the holidays i had re-imaged Every machine in school, upgraded the Nics and memory etc... Everything seemed fine untill the first day back. Despite having every machine up and installing software etc the day before (which was hunkey-dorey) everything just ground to a holt as soon at the teachers and kids hit. FYI The users have redirected folders, no roaming profiles. The XP clients were sat on "Preparing Network Connections" or "applying Computer Settings" for nearly 30 minutes before the logon dialogue appeared. Then logon would take a good 20 minutes too. When you were in there was problems with shares, they would just come and go. The DC its self was a 40 minute wait to logon aswell. and once you were in is was dog slow. Yet memory usage was normal, network traffic and processors were next to nothing. The Raid of this server was for some reason rebuilding its self. I sort of put it down to that, and next day everything seemed normal again. But today the same thing............. When i got the call it was a 20 minute logon to the DC, i rebooted it and could logon as normal, 5 seconds or so but after an hour it all went to pot again. A friend thinks its a DNS problem as of late we have had a few cases of Machine names not resolving to the correct IP's The Clients are XP SP3 and W7 SP1 2 DC's running DNS and one of those does the DHCP. After looking around on here i have tried adding the domain name to section 15 In the DHCP settings Deleted all the client entries from both DNS servers. Added the second DNS to the DHCP Settings Changed DHCP to force DNS updates if the client doesnt request them. Scavinaged Both DNS's for stale records. I will add to the note that the DC has alot of DCOM errors in the Event viewer which i cant get to the bottom of. Error 10016. Could this be to blame? Unfortunatly, i cant seem to wake any of the clients remotly for some reason so i dont know if any of this has helped. Your thoughts?
bodminman Posted May 3, 2011 Posted May 3, 2011 Have you tried remoting clients using the IP address instead of the machine names?
Dos_Box Posted May 3, 2011 Posted May 3, 2011 The Raid of this server was for some reason rebuilding its self. I sort of put it down to that, and next day everything seemed normal again. RAID Arrays do not, as a rule, randomly rebuild themselves. I suggest you dig deeper as there may be a bigger problem about to occur. A faulty disk/RAID array will cause random problems like those described. DNS too can cause issues such as this, but I suspect that you may have a disk(s) that will need swapping out soon and what you are seeing is symtomatic of this. I may be wrong, but that would be my guess. You will have to check your RAID diagnostics for further infomation.
Universally_challenged Posted May 3, 2011 Author Posted May 3, 2011 @bodminman - yes, if i look in the dhcp records for the machines IP your straight in. Go via machine name and something your connected to a totally different machine. @Dos_Box - i was way to busy that day and was maybe hoping that would have been why the system was so unresponsive... I recall it having a bad restart that morning due to just every app /servicve/ you name it just not responding.. it was probably just resyncing the drives after a abrupt restart. Drives since then have checked All Ok
bodminman Posted May 3, 2011 Posted May 3, 2011 Universally_challenged;668202]@bodminman - yes, if i look in the dhcp records for the machines IP your straight in. Go via machine name and something your connected to a totally different machine. Certainly sounds like dns to me. What about date/time settings across the site. How are these set?
Universally_challenged Posted May 3, 2011 Author Posted May 3, 2011 I have re-installed the software that the DCOM errors were refering to and they have stopped. I wiped the system event log and restarted the DC a short time ago. now i have these errors. ----------------------------------------------- Event Type: Warning Event Source: WinRM Event Category: None Event ID: 10154 Date: 03/05/2011 Time: 22:03:37 User: N/A Computer: STGRG1 Description: The WinRM service failed to create the following SPNs: WSMAN/stgrg1.stgrgb16.bham.sch.uk; WSMAN/stgrg1. Additional Data The error received was 8344: Insufficient access rights to perform the operation. . User Action The SPNs can be created by an administrator using setspn.exe utility. For more information, see Help and Support Center at Events and Errors Message Center: Basic Search. ---------------------------------------------------- and this one ---------------------------------------------------------- Event Type: Warning Event Source: DhcpServer Event Category: None Event ID: 1056 Date: 03/05/2011 Time: 22:03:45 User: N/A Computer: STGRG1 Description: The DHCP service has detected that it is running on a DC and has no credentials configured for use with Dynamic DNS registrations initiated by the DHCP service. This is not a recommended security configuration. Credentials for Dynamic DNS registrations may be configured using the command line "netsh dhcp server set dnscredentials" or via the DHCP Administrative tool. For more information, see Help and Support Center at Events and Errors Message Center: Basic Search. Data: 0000: 00 00 00 00 ....
bodminman Posted May 3, 2011 Posted May 3, 2011 I have re-installed the software that the DCOM errors were refering to and they have stopped. I wiped the system event log and restarted the DC a short time ago. now i have these errors. ---------------------------------------------------------- Event Type: Warning Event Source: DhcpServer Event Category: None Event ID: 1056 Date: 03/05/2011 Time: 22:03:45 User: N/A Computer: STGRG1 Description: The DHCP service has detected that it is running on a DC and has no credentials configured for use with Dynamic DNS registrations initiated by the DHCP service. This is not a recommended security configuration. Credentials for Dynamic DNS registrations may be configured using the command line "netsh dhcp server set dnscredentials" or via the DHCP Administrative tool. For more information, see Help and Support Center at Events and Errors Message Center: Basic Search. Data: 0000: 00 00 00 00 .... Have a look at Event ID 1056 Is Logged After Installing DHCP
bodminman Posted May 3, 2011 Posted May 3, 2011 I have re-installed the software that the DCOM errors were refering to and they have stopped. I wiped the system event log and restarted the DC a short time ago. now i have these errors. ----------------------------------------------- Event Type: Warning Event Source: WinRM Event Category: None Event ID: 10154 Date: 03/05/2011 Time: 22:03:37 User: N/A Computer: STGRG1 Description: The WinRM service failed to create the following SPNs: WSMAN/stgrg1.stgrgb16.bham.sch.uk; WSMAN/stgrg1. Additional Data The error received was 8344: Insufficient access rights to perform the operation. . User Action The SPNs can be created by an administrator using setspn.exe utility. For more information, see Help and Support Center at Events and Errors Message Center: Basic Search. ---------------------------------------------------- Have a look at this thread too: Bug? Event ID 10154 (WinRM service failed to create the following SPNs...)
Universally_challenged Posted May 3, 2011 Author Posted May 3, 2011 (edited) @bodminman Was just reading up on these two. seems to be conflicting infomation ref the DHCP. Do you thing i should create a Domain Admin account just for this and enter the credentials? Edited May 3, 2011 by Universally_challenged
Universally_challenged Posted May 4, 2011 Author Posted May 4, 2011 as of yet i still havent nailed this one. sorted the DCOM errors. have kerberos and other errors now. this has to be something simple.....
strawberry Posted May 4, 2011 Posted May 4, 2011 Have a look at the disk access on your server using performance monitoring tools, I really think you need to be 100% that the array rebuilding isn't causing this, you've said that the processor and ram were normal which usually means your dog slow server has disk access problems which are likely caused by the rebuilding, you might find that the failing disk comes back to life for periods which would cause the sort of intermittent problems your seeing, espically on a dc.
Dos_Box Posted May 4, 2011 Posted May 4, 2011 Which is what I said earlier. I suspect he's trying to fix the symptoms, not the cause.
Gibbo Posted May 5, 2011 Posted May 5, 2011 The XP clients were sat on "Preparing Network Connections" or "applying Computer Settings" for nearly 30 minutes before the logon dialogue appeared. There was a Windows Update a couple of weeks ago which made the "applying Computer Settings" prompt seem to take a bit longer than normal, but a couple of reboots later it was fine. I think it was configuring the latest .NET.
Universally_challenged Posted May 7, 2011 Author Posted May 7, 2011 sorry, i thought i put a reply up. The machine now has 2 new drives in it. and the only error in the event log is a Kerbos one. -------------------------------------- Event Type: Error Event Source: Kerberos Event Category: None Event ID: 3 Date: 07/05/2011 Time: 14:05:20 User: N/A Computer: S****1 Description: A Kerberos Error Message was received: on logon session Client Time: Server Time: 13:5:20.0000 5/7/2011 Z Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN Extended Error: Client Realm: Client Name: Server Realm: ********.****.SCH.UK Server Name: s****1.********.****.sch.uk Target Name: s****1.********.sch.uk@********.****.SCH.UK Error Text: File: 9 Line: b22 Error Data is in record data. For more information, see Help and Support Center at Events and Errors Message Center: Basic Search. ------------------------------------------------ Im led to believe that this could be due to DNS Problems. (which have been about for a while.) I have demoted the second DC and removed DNS off of that a couple of days ago, so were are just down to this one. The second DNS is still showing in the DNS records as a name server. should i remove this or will ir go by itsself. I know NOTHING anoud DNS, its just self learning black magic to me. So where do you start about trouble shooting it? is there a way to just factory fresh it?
sukh Posted May 7, 2011 Posted May 7, 2011 1. What OS are your DC, include SP level 2. Forest/Domain structure? and Level 3. Is this issue for all Win XP clients and Win 7 or only Win XP? 4. How many AD sites? 5. Run the ADBpa and to check for errors and fix critical. 6. Is this slow logon all the time or random. Pick one client, can you easily reprocue the issue ? Sukh
witch Posted May 7, 2011 Posted May 7, 2011 Completely off the wall - it isnt the anti-virus, is it? I had an issue whereby the logons went really slow all of a sudden - slower and slower over the day and it turned out to be the antivirus set to check everything every time the server was accessed. I had recently rebuilt the antivirus and didnt know to stop this. I'm sure it probably isnt, it is just that your problem is so similar to mine
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now